<!DOCTYPE html
  PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
  "DTD/xhtml1-strict.dtd">
<html>
  <head>
    <title>volatility.plugins.gui.win32k_core._RTL_ATOM_TABLE : API documentation</title>
    <meta content="text/html;charset=utf-8" http-equiv="Content-Type" />
    <link href="apidocs.css" type="text/css" rel="stylesheet" />
    
    
  </head>
  <body>
    <h1 class="class private">v.p.g.w._RTL_ATOM_TABLE(<a href="volatility.plugins.gui.win32k_core.tagWINDOWSTATION.html">tagWINDOWSTATION</a>) : class documentation</h1>
    <p>
      <span id="part">Part of <a href="volatility.html">volatility</a>.<a href="volatility.plugins.html">plugins</a>.<a href="volatility.plugins.gui.html">gui</a>.<a href="volatility.plugins.gui.win32k_core.html">win32k_core</a></span>
      
      <a href="classIndex.html#volatility.plugins.gui.win32k_core._RTL_ATOM_TABLE">View In Hierarchy</a>
    </p>
    <div>
      
    </div>
    <div>A class for atom tables<table class="fieldTable"></table></div>

    
    
    <div id="splitTables">
      <table class="children sortable" id="id400">
  
  
<tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.gui.win32k_core._RTL_ATOM_TABLE.html#__init__">__init__</a></td>
    <td><span>Give ourselves an atom cache for quick lookups</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.gui.win32k_core._RTL_ATOM_TABLE.html#is_valid">is_valid</a></td>
    <td><span>Check for validity based on the atom table signature and the maximum allowed number of buckets</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.gui.win32k_core._RTL_ATOM_TABLE.html#atoms">atoms</a></td>
    <td><span>Carve all atoms out of this atom table</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.gui.win32k_core._RTL_ATOM_TABLE.html#find_atom">find_atom</a></td>
    <td><span>Find an atom by its ID.</span></td>
  </tr>
  
</table>
      
        <p>
          Inherited from <a href="volatility.plugins.gui.win32k_core.tagWINDOWSTATION.html">tagWINDOWSTATION</a>:
        </p>
        <table class="children sortable" id="id401">
  
  
<tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.gui.win32k_core.tagWINDOWSTATION.html#PhysicalAddress">PhysicalAddress</a></td>
    <td><span>This is a simple wrapper to always return the object's physical offset regardless of what AS its instantiated in</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.gui.win32k_core.tagWINDOWSTATION.html#LastRegisteredViewer">LastRegisteredViewer</a></td>
    <td><span>The EPROCESS of the last registered clipboard viewer</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.gui.win32k_core.tagWINDOWSTATION.html#AtomTable">AtomTable</a></td>
    <td><span>This atom table belonging to this window station object</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.gui.win32k_core.tagWINDOWSTATION.html#Interactive">Interactive</a></td>
    <td><span>Check if a window station is interactive</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.gui.win32k_core.tagWINDOWSTATION.html#Name">Name</a></td>
    <td><span>Get the window station name.</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.gui.win32k_core.tagWINDOWSTATION.html#traverse">traverse</a></td>
    <td><span>A generator that yields window station objects</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.gui.win32k_core.tagWINDOWSTATION.html#desktops">desktops</a></td>
    <td><span>A generator that yields the window station's desktops</span></td>
  </tr>
  
</table>
      
        <p>
          Inherited from <a href="volatility.obj.CType.html">CType</a> (via <a href="volatility.plugins.gui.win32k_core.tagWINDOWSTATION.html">tagWINDOWSTATION</a>):
        </p>
        <table class="children sortable" id="id402">
  
  
<tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.CType.html#size">size</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.CType.html#__repr__">__repr__</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.CType.html#d">d</a></td>
    <td><span>Display diagnostic information</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.CType.html#v">v</a></td>
    <td><span>When a struct is evaluated we just return our offset.</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.CType.html#m">m</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.CType.html#__getattr__">__getattr__</a></td>
    <td><span>This is only useful for proper methods (not ones that start with __ )</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.CType.html#__setattr__">__setattr__</a></td>
    <td><span>Change underlying members</span></td>
  </tr>
  
</table>
      
        <p>
          Inherited from <a href="volatility.obj.BaseObject.html">BaseObject</a> (via <a href="volatility.plugins.gui.win32k_core.tagWINDOWSTATION.html">tagWINDOWSTATION</a>, <a href="volatility.obj.CType.html">CType</a>):
        </p>
        <table class="children sortable" id="id403">
  
  
<tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#obj_type">obj_type</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#obj_vm">obj_vm</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#obj_offset">obj_offset</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#obj_parent">obj_parent</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#obj_name">obj_name</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#obj_native_vm">obj_native_vm</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#set_native_vm">set_native_vm</a></td>
    <td><span>Sets the native_vm</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#rebase">rebase</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#proxied">proxied</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#newattr">newattr</a></td>
    <td><span>Sets a new attribute after the object has been created</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#write">write</a></td>
    <td><span>Function for writing the object back to disk</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#__nonzero__">__nonzero__</a></td>
    <td><span class="undocumented">No summary</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#__eq__">__eq__</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#__ne__">__ne__</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#__hash__">__hash__</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#dereference">dereference</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#dereference_as">dereference_as</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#cast">cast</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#__format__">__format__</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#__str__">__str__</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#__getstate__">__getstate__</a></td>
    <td><span>This controls how we pickle and unpickle the objects</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#__setstate__">__setstate__</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr>
  
</table>
      
      
    </div>
    
    
    

    <div class="function">
  <a name="volatility.plugins.gui.win32k_core._RTL_ATOM_TABLE.__init__">
    
  </a>
  <a name="__init__">
    
  </a>
  <div class="functionHeader">
    
    def
    __init__(self, *args, **kwargs):
    
  </div>
  <div class="functionBody">
    <div class="interfaceinfo">overrides <a href="volatility.obj.CType.html#__init__">volatility.obj.CType.__init__</a></div>
    <div>Give ourselves an atom cache for quick lookups<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.gui.win32k_core._RTL_ATOM_TABLE.is_valid">
    
  </a>
  <a name="is_valid">
    
  </a>
  <div class="functionHeader">
    
    def
    is_valid(self):
    
  </div>
  <div class="functionBody">
    <div class="interfaceinfo">overrides <a href="volatility.plugins.gui.win32k_core.tagWINDOWSTATION.html#is_valid">volatility.plugins.gui.win32k_core.tagWINDOWSTATION.is_valid</a></div>
    <div>Check for validity based on the atom table signature
and the maximum allowed number of buckets<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.gui.win32k_core._RTL_ATOM_TABLE.atoms">
    
  </a>
  <a name="atoms">
    
  </a>
  <div class="functionHeader">
    
    def
    atoms(self):
    
  </div>
  <div class="functionBody">
    
    <div>Carve all atoms out of this atom table<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.gui.win32k_core._RTL_ATOM_TABLE.find_atom">
    
  </a>
  <a name="find_atom">
    
  </a>
  <div class="functionHeader">
    
    def
    find_atom(self, atom_to_find):
    
  </div>
  <div class="functionBody">
    
    <div>Find an atom by its ID.</p>
<p>&#64;param atom_to_find: the atom ID (ushort) to find</p>
<p>&#64;returns an _RTL_ATOM_TALE_ENTRY object<table class="fieldTable"></table></div>
  </div>
</div>
    <address>
      <a href="index.html">API Documentation</a> for Volatility 2.2, generated by <a href="http://codespeak.net/~mwh/pydoctor/">pydoctor</a> at 2013-06-24 15:16:10.
    </address>
  </body>
</html>